https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-13T11:39:45.600889+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-78416 fkie_cve-2026-78416 2026-10-13T11:39:45.625523+00:00

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.

 https://db.gcve.eu/vuln/ghsa-4ghj-75g5-h9pf GHSA-4ghj-75g5-h9pf 2026-10-13T11:39:45.625598+00:00

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.